9 ms·

If I were to build the nixCraft blog again today, I would avoid WordPress. It lost core value a long time ago. They are forcing unwanted features with block edi

If I were to build the nixCraft blog again today, I would avoid WordPress. It lost core value a long time ago. They are forcing unwanted features with block editor (gutenberg or whatever it is called) and whatnot. Take a look at Classic Widgets[1] and Classic Editor[2] plugins. Both are downloaded over million times just to restore old functionality. They no longer listen to the community. Not to mention it is the number # 1 target for hackers due to its massive popularity and vulnerabilities in WP codebase. We need to continuously apply updates to WP and its ecosystem. I will not dare put WP on the Internet without Cloudflare WAF WP ruleset or Nginx/Apache WAF[3]. It is madness out there. However, I am still thankful for the WP opensource edition. I learned all of my JS, CSS, HTML, and PHP skills as I have done everything myself since 2003. Just some random Sunday rant. [1] https://wordpress.org/plugins/classic-editor/ https://wordpress.org/plugins/classic-editor/ [2] https://wordpress.org/plugins/classic-widgets/ https://wordpress.org/plugins/classic-widgets/ [3] https://docs.nginx.com/nginx-waf/ https://docs.nginx.com/nginx-waf/ https://www.cloudflare.com/en-gb/waf/ https://www.cloudflare.com/en-gb/waf/

kijin 5y ago
The vast majority of known vulnerabilities are in the plugin ecosystem, not WordPress itself. The core codebase is remarkably well-maintained (of course, due to its massive popularity) considering its age and dedication to backward compatibility.
- seanwilson 5y ago
  WordPress core is lacking a lot of features you'd expect for basic sites though (e.g. contact forms, caching, FAQ, SEO tags, social sharing) so anything but basic blogs require plugins or custom code. A big draw of WordPress is that non-developers can customise it with all the plugins that are available, so saying WordPress is secure as long as you avoid plugins nullifies this. It's terrifying that a contact form or caching plugin that you need to install because the functionality isn't built-in could result in a remote code execution exploit.
  - kijin 5y ago
    Even if the features you mentioned were included in WordPress core, they would be implemented as plugins that can be replaced with other plugins. IMO the problem with the plugin ecosystem is not that they're required, but that so much of the well-known plugins are bloated crap. Popular SEO plugins don't stop at inserting SEO tags into your <head>. They come with AMP integration, an online robots.txt editor, automatic content generator, competitor site analyzer, spam blocker, and even a rudimentary caching feature to speed up your site! Meanwhile, caching plugins offer to minify your javascript, photo galleries include a Stripe payment gateway, and contact forms come with their own markup language. Everyone is trying to do everything, everyone is stepping on everyone else's toes, and it's impossible for anyone to maintain all the unrelated features that are bundled together in each plugin. There are really neat plugins that do one thing, do it well, and are easy to audit. Sadly, they are buried under all the spammy alternatives. WordPress really needs to invest in a better plugin search & ranking system that discourages bloat and offers incentives for high-quality code, perhaps by integrating some sort of static analyzer.
    - seanwilson 5y ago
      > Even if the features you mentioned were included in WordPress core, they would be implemented as plugins that can be replaced with other plugins. > ... Everyone is trying to do everything, everyone is stepping on everyone else's toes, and it's impossible for anyone to maintain all the unrelated features that are bundled together in each plugin. If these plugins were in core though, they'd likely have much better security and be less bloated. The problem with the plugin ecosystem you mention I think stems from monetization - there's the incentive to stuff freemium plugins with functionality so you can charge for paid features. I really don't know how WordPress can reign this in. I think the WordPress core that plugins build upon has bad security fundamentals as well e.g. the default PHP templating language doesn't even escape strings by default, most theme and plugin file permissions aren't locked down to read-only, Git-based versioning and deploys isn't built-in or widely practiced. > There are really neat plugins that do one thing, do it well, and are easy to audit. What plugins would you recommend? I find you can get pretty far with Advanced Custom Fields and an SEO plugin.
    - 5y ago
inglor_cz 5y ago
The block editor is controversial. I like it, but people who are more conservative around technology hate it with passion. I agree that it shouldn't be pushed too hard, but the WordPress team probably doesn't have enough resources to maintain both.
- panicpanicpanic 5y ago
  The block editor has been called out for technical problems often but I feel the writing experience it offers should be discussed as well. For example cursor behaviour in the block editor is unpredictable, and with large posts the bloody thing starts to hang now and then.
  - dmix 5y ago
    What was the editor built with?
    - marc_io 5y ago
      It was built in React.
- laurent92 5y ago
  > probably doesn’t have enough resources to maintain both. So why break a perfectly functional feature, if they are on a tight line? Just to compete with Notion.io? Stop trying to gob the next market when you don’t have enough resources to maintain your own stack. Remember when Ubuntu created the Unity desktop and made all Gnome users angry, just to try to gob the mobile/tablet market? I’ve tried to use it for 2 years and left. Is Ubuntu the OS of any mobile phone today?
  - apatters 5y ago
    They built Gutenberg because a significant and growing percentage of the user base was resorting to page builder plugins like Divi, Elementor etc. to create richer layouts than what the classic editor could handle. These plugins have a lot of drawbacks: non-portability of content, they break the WP theming model, they cost money, they've historically had performance/security/stability issues, etc. Basically WP did not want to cede control over something as essential as the editing experience to a bunch of third parties, but it was happening because of the limitations of the classic editor. I have issues with some elements of how they approached the problem but doing nothing would have been a worse choice. I can't say that I've seen a simple, blog-like project where using Gutenberg was a big negative. The classic editor will probably always be around, it's just a wrapper around TinyMCE and there's tons of community interest in keeping it alive.
richardfey 5y ago
Maybe this is due to an attempt to compete with Wix?
- unfocussed_mike 5y ago
  Yes -- Wix (who misused GPL WP code) and Squarespace. But also, on the WooCommerce side, Shopify and BigCartel. The other thing is that really at this point block editors are everywhere; they are in every email marketing tool, they are in some social media sites, they are in other CMSes. A block editor isn't optional at this point. Nor is block layout editing. And pointing at a million people who install a plugin to keep the classic editor functionality is not the same as pointing at a million people who don't want Gutenberg. It's pointing at a million people who have a variety of reasons not to upgrade older existing content to blocks, but who still need to edit that content (e.g. complex/ill-advised shortcode setups, specific markup etc.) (The Classic Editor plugin is not either/or -- you can decide to use it per post or per user.)
  - richardfey 5y ago
    Do these users have a choice? e.g. export their data and use it on a self-hosted instance or another provider that wants to offer something akin the previous wordpress.com? TFA didn't cover this aspect.
    - desas 5y ago
      Yes, https://wordpress.com/support/export/ https://wordpress.com/support/export/
politelemon 5y ago
If nixcraft = cyberciti.biz, your site has been invaluable to me over the years, I (and I'm sure countless others) really appreciate you running it.
- nixcraft 5y ago
  yes, thank you for the kind words.
qualudeheart 5y ago
Wordpress is a security nightmare. Avoid it if you can.
panicpanicpanic 5y ago
Out of curiosity, what would you use to build nixCraft if you had to start over?
- nixcraft 5y ago
  I will use a static blog generator (or probably write my own in Perl/ Python). I just want simple stuff. In the early days, WP was simple, and I loved it. Now, it turned into a hot mess—every primary functionality (like anti-spam or form) needed a plugin which is a significant source of pain. Fun fact, b2 was slowly dying and had few issues, so they created a b2 fork known as WP. Then Movable Type messed up with its userbase in 2004, and those users did mass migration to WP, and the rest is the history.
achairapart 5y ago
WordPress(.org) has completely lost it. It started outputting real junk in the html[0], out of the blue. This kind of stuff should be at least opt-in. With this block madness it turned from a "semantic publishing platform" to some lousy PowerPoint for the web. It's time for a hard fork, or for some new project/idea to disrupt it. It may take some time, but this is something inevitable at this point. [0]: https://github.com/WordPress/gutenberg/issues/38299 https://github.com/WordPress/gutenberg/issues/38299
- unfocussed_mike 5y ago
  The duotones bit is odd, for sure! > With this block madness it turned from a "semantic publishing platform" to some lousy PowerPoint for the web. But here you're wrong. There is now more semantic information available to content-transforming plugins, not less, thanks to the block editor. The content is still stored as HTML in post_content (which they do to support exporting the content as HTML), but because of its annotations, you can get the entire block parse tree from a single function call, on the server side: https://awhitepixel.com/blog/wordpress-gutenberg-access-parse-blocks-with-php/ https://awhitepixel.com/blog/wordpress-gutenberg-access-pars... So for the first time, the semantics of page content are exposed in a way that does not involve trying to parse chunks of HTML yourself (except the "classic editor" block if you want to parse into that). > It's time for a hard fork, or for some new project/idea to disrupt it. There's already been a hard fork of WP that might suit you: https://www.classicpress.net/ https://www.classicpress.net/
  - achairapart 5y ago
    Ok, let's not talk about the duotone bit. Let's talk about patterns: https://wordpress.org/patterns/ https://wordpress.org/patterns/ Why on earth should I include these very beautiful and also very random bird illustrations and colors and typography into my website? Are these "pattern" in the sense of reusable solution to common problems or just random and non-consistent design blocks? Also, why on earth should I control border-radii, gradient, colors for every single block in the editor?[0][1] This is complete madness. For two reasons at least: One, styles should be defined at least on a global level, using tokenized values and possibly exposed only to users with higher capabilities (designers). Two, authors and editors should focus on content, not styling. Many of them are unable to take rational design decisions. Giving them the power of styling border radii or gradients on multiple buttons/elements in a random fashion on the same page, or even on the same website, is a recipe for a visual disaster. Yes, you're right about how the semantic data may be stored. Everything else? I can still see a "lousy PowerPoint for the web" everywhere. What's worst, is that they are pushing these bad design decisions really hard. Breaking existing websites in production. Maybe they'll make it right someday, at least I hope so, but it will take years time. This is why, as I said, all of this should be at least opt-in. [0]: https://github.com/WordPress/gutenberg/pull/28541 https://github.com/WordPress/gutenberg/pull/28541 [1]: https://github.com/WordPress/gutenberg/pull/31585 https://github.com/WordPress/gutenberg/pull/31585
snowwrestler 5y ago
Security is one of the strong points of Wordpress because of the steady flow of patches. All you have to do is install them quickly. If you can do that, I would not hesitate to put WP online without a WAF. Almost all attempts on WP sites are scripted attacks on vulnerabilities that have already been patched. Patches are good. Saying WP must be insecure because of all the patches is like saying a fancy restaurant bathroom must be filthy because it gets cleaned 4 times a day.
deleted 5y ago
[deleted]
- deleted 5y ago
  [deleted]
_fat_santa 5y ago
One thing I hated about Wordpress is the ecosystem around it. Everything was money money money. Coming from React/JS development, you get used to resources being out there. Need a solution for X? Well you will most likely find a free and OSS solution. With WP it seems that the smallest of add-ons cost money. Even for stuff that is open source elsewhere, the authors have re-packaged it into a subscription service. My other major gripe is the community. With almost any other platform you can find answers to questions pretty easy. With Wordpress over half the articles I found to issues were blatant SEO spam. Paragraph, paragraph, paragraph, tiny nugget of not useful info, BUY MY ADDON TO FIX THIS ISSUE FOR GOOD! Often times I came across thread where a person would post: "Oh I know how to fix this, but please buy my consulting services to learn the answer".

kijin 5y ago

The vast majority of known vulnerabilities are in the plugin ecosystem, not WordPress itself. The core codebase is remarkably well-maintained (of course, due to its massive popularity) considering its age and dedication to backward compatibility.

seanwilson 5y ago
WordPress core is lacking a lot of features you'd expect for basic sites though (e.g. contact forms, caching, FAQ, SEO tags, social sharing) so anything but basic blogs require plugins or custom code. A big draw of WordPress is that non-developers can customise it with all the plugins that are available, so saying WordPress is secure as long as you avoid plugins nullifies this. It's terrifying that a contact form or caching plugin that you need to install because the functionality isn't built-in could result in a remote code execution exploit.
- kijin 5y ago
  Even if the features you mentioned were included in WordPress core, they would be implemented as plugins that can be replaced with other plugins. IMO the problem with the plugin ecosystem is not that they're required, but that so much of the well-known plugins are bloated crap. Popular SEO plugins don't stop at inserting SEO tags into your <head>. They come with AMP integration, an online robots.txt editor, automatic content generator, competitor site analyzer, spam blocker, and even a rudimentary caching feature to speed up your site! Meanwhile, caching plugins offer to minify your javascript, photo galleries include a Stripe payment gateway, and contact forms come with their own markup language. Everyone is trying to do everything, everyone is stepping on everyone else's toes, and it's impossible for anyone to maintain all the unrelated features that are bundled together in each plugin. There are really neat plugins that do one thing, do it well, and are easy to audit. Sadly, they are buried under all the spammy alternatives. WordPress really needs to invest in a better plugin search & ranking system that discourages bloat and offers incentives for high-quality code, perhaps by integrating some sort of static analyzer.
  - seanwilson 5y ago
    > Even if the features you mentioned were included in WordPress core, they would be implemented as plugins that can be replaced with other plugins. > ... Everyone is trying to do everything, everyone is stepping on everyone else's toes, and it's impossible for anyone to maintain all the unrelated features that are bundled together in each plugin. If these plugins were in core though, they'd likely have much better security and be less bloated. The problem with the plugin ecosystem you mention I think stems from monetization - there's the incentive to stuff freemium plugins with functionality so you can charge for paid features. I really don't know how WordPress can reign this in. I think the WordPress core that plugins build upon has bad security fundamentals as well e.g. the default PHP templating language doesn't even escape strings by default, most theme and plugin file permissions aren't locked down to read-only, Git-based versioning and deploys isn't built-in or widely practiced. > There are really neat plugins that do one thing, do it well, and are easy to audit. What plugins would you recommend? I find you can get pretty far with Advanced Custom Fields and an SEO plugin.
  - 5y ago

inglor_cz 5y ago

The block editor is controversial. I like it, but people who are more conservative around technology hate it with passion. I agree that it shouldn't be pushed too hard, but the WordPress team probably doesn't have enough resources to maintain both.

panicpanicpanic 5y ago
The block editor has been called out for technical problems often but I feel the writing experience it offers should be discussed as well. For example cursor behaviour in the block editor is unpredictable, and with large posts the bloody thing starts to hang now and then.
- dmix 5y ago
  What was the editor built with?
  - marc_io 5y ago
    It was built in React.
laurent92 5y ago
> probably doesn’t have enough resources to maintain both. So why break a perfectly functional feature, if they are on a tight line? Just to compete with Notion.io? Stop trying to gob the next market when you don’t have enough resources to maintain your own stack. Remember when Ubuntu created the Unity desktop and made all Gnome users angry, just to try to gob the mobile/tablet market? I’ve tried to use it for 2 years and left. Is Ubuntu the OS of any mobile phone today?
- apatters 5y ago
  They built Gutenberg because a significant and growing percentage of the user base was resorting to page builder plugins like Divi, Elementor etc. to create richer layouts than what the classic editor could handle. These plugins have a lot of drawbacks: non-portability of content, they break the WP theming model, they cost money, they've historically had performance/security/stability issues, etc. Basically WP did not want to cede control over something as essential as the editing experience to a bunch of third parties, but it was happening because of the limitations of the classic editor. I have issues with some elements of how they approached the problem but doing nothing would have been a worse choice. I can't say that I've seen a simple, blog-like project where using Gutenberg was a big negative. The classic editor will probably always be around, it's just a wrapper around TinyMCE and there's tons of community interest in keeping it alive.

richardfey 5y ago

Maybe this is due to an attempt to compete with Wix?

unfocussed_mike 5y ago
Yes -- Wix (who misused GPL WP code) and Squarespace. But also, on the WooCommerce side, Shopify and BigCartel. The other thing is that really at this point block editors are everywhere; they are in every email marketing tool, they are in some social media sites, they are in other CMSes. A block editor isn't optional at this point. Nor is block layout editing. And pointing at a million people who install a plugin to keep the classic editor functionality is not the same as pointing at a million people who don't want Gutenberg. It's pointing at a million people who have a variety of reasons not to upgrade older existing content to blocks, but who still need to edit that content (e.g. complex/ill-advised shortcode setups, specific markup etc.) (The Classic Editor plugin is not either/or -- you can decide to use it per post or per user.)
- richardfey 5y ago
  Do these users have a choice? e.g. export their data and use it on a self-hosted instance or another provider that wants to offer something akin the previous wordpress.com? TFA didn't cover this aspect.
  - desas 5y ago
    Yes, https://wordpress.com/support/export/ https://wordpress.com/support/export/

politelemon 5y ago

If nixcraft = cyberciti.biz, your site has been invaluable to me over the years, I (and I'm sure countless others) really appreciate you running it.

nixcraft 5y ago
yes, thank you for the kind words.

qualudeheart 5y ago

Wordpress is a security nightmare. Avoid it if you can.

panicpanicpanic 5y ago

Out of curiosity, what would you use to build nixCraft if you had to start over?

nixcraft 5y ago
I will use a static blog generator (or probably write my own in Perl/ Python). I just want simple stuff. In the early days, WP was simple, and I loved it. Now, it turned into a hot mess—every primary functionality (like anti-spam or form) needed a plugin which is a significant source of pain. Fun fact, b2 was slowly dying and had few issues, so they created a b2 fork known as WP. Then Movable Type messed up with its userbase in 2004, and those users did mass migration to WP, and the rest is the history.

achairapart 5y ago

WordPress(.org) has completely lost it. It started outputting real junk in the html[0], out of the blue. This kind of stuff should be at least opt-in. With this block madness it turned from a "semantic publishing platform" to some lousy PowerPoint for the web. It's time for a hard fork, or for some new project/idea to disrupt it. It may take some time, but this is something inevitable at this point. [0]: https://github.com/WordPress/gutenberg/issues/38299 https://github.com/WordPress/gutenberg/issues/38299

unfocussed_mike 5y ago
The duotones bit is odd, for sure! > With this block madness it turned from a "semantic publishing platform" to some lousy PowerPoint for the web. But here you're wrong. There is now more semantic information available to content-transforming plugins, not less, thanks to the block editor. The content is still stored as HTML in post_content (which they do to support exporting the content as HTML), but because of its annotations, you can get the entire block parse tree from a single function call, on the server side: https://awhitepixel.com/blog/wordpress-gutenberg-access-parse-blocks-with-php/ https://awhitepixel.com/blog/wordpress-gutenberg-access-pars... So for the first time, the semantics of page content are exposed in a way that does not involve trying to parse chunks of HTML yourself (except the "classic editor" block if you want to parse into that). > It's time for a hard fork, or for some new project/idea to disrupt it. There's already been a hard fork of WP that might suit you: https://www.classicpress.net/ https://www.classicpress.net/
- achairapart 5y ago
  Ok, let's not talk about the duotone bit. Let's talk about patterns: https://wordpress.org/patterns/ https://wordpress.org/patterns/ Why on earth should I include these very beautiful and also very random bird illustrations and colors and typography into my website? Are these "pattern" in the sense of reusable solution to common problems or just random and non-consistent design blocks? Also, why on earth should I control border-radii, gradient, colors for every single block in the editor?[0][1] This is complete madness. For two reasons at least: One, styles should be defined at least on a global level, using tokenized values and possibly exposed only to users with higher capabilities (designers). Two, authors and editors should focus on content, not styling. Many of them are unable to take rational design decisions. Giving them the power of styling border radii or gradients on multiple buttons/elements in a random fashion on the same page, or even on the same website, is a recipe for a visual disaster. Yes, you're right about how the semantic data may be stored. Everything else? I can still see a "lousy PowerPoint for the web" everywhere. What's worst, is that they are pushing these bad design decisions really hard. Breaking existing websites in production. Maybe they'll make it right someday, at least I hope so, but it will take years time. This is why, as I said, all of this should be at least opt-in. [0]: https://github.com/WordPress/gutenberg/pull/28541 https://github.com/WordPress/gutenberg/pull/28541 [1]: https://github.com/WordPress/gutenberg/pull/31585 https://github.com/WordPress/gutenberg/pull/31585

snowwrestler 5y ago

Security is one of the strong points of Wordpress because of the steady flow of patches. All you have to do is install them quickly. If you can do that, I would not hesitate to put WP online without a WAF. Almost all attempts on WP sites are scripted attacks on vulnerabilities that have already been patched. Patches are good. Saying WP must be insecure because of all the patches is like saying a fancy restaurant bathroom must be filthy because it gets cleaned 4 times a day.

deleted 5y ago

[deleted]

deleted 5y ago
[deleted]

_fat_santa 5y ago

One thing I hated about Wordpress is the ecosystem around it. Everything was money money money. Coming from React/JS development, you get used to resources being out there. Need a solution for X? Well you will most likely find a free and OSS solution. With WP it seems that the smallest of add-ons cost money. Even for stuff that is open source elsewhere, the authors have re-packaged it into a subscription service. My other major gripe is the community. With almost any other platform you can find answers to questions pretty easy. With Wordpress over half the articles I found to issues were blatant SEO spam. Paragraph, paragraph, paragraph, tiny nugget of not useful info, BUY MY ADDON TO FIX THIS ISSUE FOR GOOD! Often times I came across thread where a person would post: "Oh I know how to fix this, but please buy my consulting services to learn the answer".